fix: Transfers were not syncing between accounts (#987)

* fix: Include investment_contribution in transfer? check and protect transfer entries from sync

Transfer transactions with kind "investment_contribution" were not recognized
as transfers by the UI, causing missing +/- indicators, "Transfer" labels,
and showing regular transaction forms instead of transfer details.

Also adds user_modified: true to entries created via TransferMatchesController
and SetAsTransferOrPayment rule action to protect them from provider sync
overwrites, matching the existing behavior in Transfer::Creator.

https://claude.ai/code/session_019BZ5Z1aqKSK3cRdR81P5Jg

* fix: Centralize transfer/budget kind constants for consistent investment_contribution handling

Define TRANSFER_KINDS and BUDGET_EXCLUDED_KINDS on Transaction to eliminate
hard-coded kind lists scattered across filters, rules, and analytics code.

investment_contribution is now consistently treated as a transfer in search
filters, rule conditions, and UI display (via TRANSFER_KINDS), while budget
analytics correctly continue treating it as an expense (via BUDGET_EXCLUDED_KINDS).

https://claude.ai/code/session_019BZ5Z1aqKSK3cRdR81P5Jg

* fix: Update tests for consistent investment_contribution as transfer kind

- search_test: loan_payment is now in TRANSFER_KINDS, so uncategorized
  filter correctly excludes it (same as funds_movement/cc_payment)
- condition_test: investment_contribution is now a transfer kind, so it
  matches the transfer filter rather than expense filter

https://claude.ai/code/session_019BZ5Z1aqKSK3cRdR81P5Jg

* fix: Eliminate SQL injection warnings in Transaction::Search

Replace string-interpolated SQL with parameterized queries:
- totals: use sanitize_sql_array with ? placeholders
- apply_category_filter: pass TRANSFER_KINDS as bind parameter
- apply_type_filter: use where(kind:)/where.not(kind:) and
  parameterized IN (?) for compound OR conditions
- Remove unused transfer_kinds_sql helper

https://claude.ai/code/session_019BZ5Z1aqKSK3cRdR81P5Jg

---------

Co-authored-by: Claude <noreply@anthropic.com>

test/models/rule/condition_test.rb

@@ -447,7 +447,7 @@ class Rule::ConditionTest < ActiveSupport::TestCase
     assert_not filtered.map(&:id).include?(transfer_entry.transaction.id)
   end
 
-  test "transaction_type expense includes investment_contribution regardless of amount sign" do
+  test "transaction_type transfer includes investment_contribution" do
     scope = @rule_scope
 
     # Create investment contribution with negative amount (inflow from provider)
@@ -463,14 +463,27 @@ class Rule::ConditionTest < ActiveSupport::TestCase
       rule: @transaction_rule,
       condition_type: "transaction_type",
       operator: "=",
-      value: "expense"
+      value: "transfer"
     )
 
     scope = condition.prepare(scope)
     filtered = condition.apply(scope)
 
-    # Should include investment_contribution even with negative amount
+    # investment_contribution is a transfer kind
     assert filtered.map(&:id).include?(contribution_entry.transaction.id)
+
+    # Should NOT match expense filter
+    expense_condition = Rule::Condition.new(
+      rule: @transaction_rule,
+      condition_type: "transaction_type",
+      operator: "=",
+      value: "expense"
+    )
+
+    expense_scope = expense_condition.prepare(@rule_scope)
+    expense_filtered = expense_condition.apply(expense_scope)
+
+    assert_not expense_filtered.map(&:id).include?(contribution_entry.transaction.id)
   end
 
   test "transaction_type income excludes investment_contribution" do